Subject: RE: Response to AD comments on draft-ietf-ipv6-unique-local-addr-03.txt

From: "Soliman Hesham" <[email-masked]>
Date: Thu, 8 Apr 2004 13:44:05 -0400

Hi Brian, 

One question/comment below:

 >  > (1) This draft doesn't mention the reverse DNS tree.  Is 
 > it expected
 >  >     that whatever registry assigns these values will also 
 > populate the
 >  >     reverse DNS tree?  Or not?
 > 
 > Given the follow-on discussion of this point, how about the following
 > replacement text for section 7.0:
 > 
 >       AAAA records (both forward and reverse) for Local IPv6 
 > addresses
 >       are not expected to be installed in the global DNS 
 > because they are
 >       intended to be used for local communication inside of 
 > a site.  They
 >       may be installed in the global DNS since they are 
 > unique and will
 >       not create confusion.  They may not be reachable, but that is a
 >       property common to all types of global IPv6 unicast addresses.

=> I wonder whether it is a good idea to put these addresses
in the global DNS at all. My understanding of having addresses
in the global DNS is that the AAAA records essentially announce
that such addresses are globally reachable (with the exception
of routing failure). However, in the case of local addresses
this is a bit of false advertising. So shouldn't
we recommend that such addresses are not to be advertised in the global
DNS? Otherwise, why are they called "local addresses"? 

Hesham

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Brian Haberman <[email-masked]>
Date: Thu, 08 Apr 2004 13:55:17 -0400

Hi Hesham,

> DNS? Otherwise, why are they called "local addresses"? 

That is why it is stated as "are not expected to be in the global DNS".
There will be issues caused by them being advertised yet not reachable.
Would you rather see a stronger statement against inclusion in the
global DNS?

My personal opinion is that they should never be in the global DNS, but
that didn't seem to be the consensus of the WG.

Regards,
Brian

---

From: "Soliman Hesham" <[email-masked]>
Date: Thu, 8 Apr 2004 14:00:06 -0400

> Would you rather see a stronger statement against inclusion in the

=> I think this makes sense. Something like "SHOULD NOT".

 > 
 > My personal opinion is that they should never be in the 
 > global DNS, 

=> Agreed.

   but
 > that didn't seem to be the consensus of the WG.

=> At least you and I agree FWIW :) 
Perhaps I missed this discussion, but I can't see 
why they should be put in the global DNS. Unless
people are trying to prove that these local addresses
don't require a two face DNS. It's a lost cause I think ;)

Hesham

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Fri, 09 Apr 2004 10:49:35 +0900

>>>>> On Thu, 8 Apr 2004 14:00:06 -0400, 
>>>>> "Soliman Hesham" <[email-masked]> said:

> don't require a two face DNS. It's a lost cause I think ;)

As Rob pointed out, we should first clarify whether we are talking
about the forward tree (using AAAA) or the reverse tree (using PTR RR
with nibble + ip6.arpa labels).  The reachability issue Hesham said in
his first response is basically only related to the forward tree.

In addition to this, I'd also like to note that
draft-ietf-dnsop-ipv6-dns-issues-04.txt recommends limited-scope
addresses not be in the global DNS:

2.1 Limited-scope Addresses

   The IPv6 addressing architecture [5] includes two kinds of local-use
   addresses: link-local (fe80::/10) and site-local (fec0::/10).  The
   site-local addresses are being deprecated [7], and are only discussed
   in Appendix A.

   Link-local addresses should never be published in DNS, because they
   have only local (to the connected link) significance [8].

(Hmm, it's not clear if this talks about the forward tree only, the
reverse tree only, or both...perhaps "both" is the intention).

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: Pekka Savola <[email-masked]>
Date: Fri, 9 Apr 2004 08:08:49 +0300 (EEST)

> reverse tree only, or both...perhaps "both" is the intention).

(note: I'm acting as an editor of that particular document, so 
suggestions are welcome.)

Ack.  Yes, it applies to both.

Note that the latter paragraph intentionally excludes the discussion 
of other kinds of limited-scope addresses from discussion, i.e., it 
only mentions why adding link-locals is bad.

The discussion of site-locals is deferred to an appendix.  The 
relevant text from there is:

   To actually use site-local addresses within a site, this implies the
   deployment of a "split-faced" or a fragmented DNS name space, for the
   zones internal to the site, and the outsiders' view to it.  The
   procedures to achieve this are not elaborated here.  The implication
   is that site-local addresses must not be published in the public DNS.

   To faciliate reverse DNS (if desired) with site-local addresses, the
   stub resolvers must look for DNS information from the local DNS
   servers, not e.g. starting from the root servers, so that the
   site-local information may be provided locally.  Note that the
   experience private addresses in IPv4 has shown that the root servers
   get loaded for requests for private address lookups in any.

(FWIW, the document just passed dnsop WGLC, and is being revised, so 
if others have issues with this, feel free to shoot them.)

Would it make sense to also include the discussion of these new unique
local addresses?  I've hesitated to do so, because they've been a
moving target, and I'd like to avoid adding anything there which could
become invalid if the document is changed prior to IESG approval.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Thu, 15 Apr 2004 23:11:25 +0900

>>>>> On Fri, 9 Apr 2004 08:08:49 +0300 (EEST), 
>>>>> Pekka Savola <[email-masked]> said:

> only mentions why adding link-locals is bad.

Yeah, I know.  The intention in my original message was that there had
been a discussion on the publication of limited-scope address in the
global DNS, and dnsop people have apparently reached a consensus,
particularly in response to the following part in this thread:

>>>>> On Thu, 08 Apr 2004 13:55:17 -0400, 
>>>>> Brian Haberman <[email-masked]> said:

> relevant text from there is:

Still, I should have referred to the accurate place in the dns-issues
draft to avoid confusion.  Not having done so was my fault...sorry
about that.

And,

> become invalid if the document is changed prior to IESG approval.

at least I didn't intend to propose including the new unique addresses
in the dnsop-ipv6-dns-issues draft.  IMO, it should ship without
waiting for the discussion about unique-local addresses.

					JINMEI, Tatuya

---

From: Bill Manning <[email-masked]>
Date: Fri, 16 Apr 2004 21:33:43 -0700 (PDT)

% => At least you and I agree FWIW :) 
% Perhaps I missed this discussion, but I can't see 
% why they should be put in the global DNS. Unless
% people are trying to prove that these local addresses
% don't require a two face DNS. It's a lost cause I think ;)
% 
% Hesham

	of course, it is impossible to dictate what people
	can and can not place into the DNS. It is useful 
	to remember that DNS lookups are useful for a number
	of different things and having all addresses in use
	being instanced in the DNS is a -VERY- useful operational
	activity.

--bill
Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).